Subject: RE: [mobile-ip] fastv6 and CoAs

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Fri, 20 Sep 2002 18:33:39 +0200

Hi James,

> => I'm not sure it's a link layer security issue.
> On a multiaccess link you can still see/spoof other
> nodes' link layer addresses even if L2 encryption
> is used. It's a property of a multiaccess link.
>
> On a p2p radio link, how does the new AR know which
> "channel/port" the MN will attach to so that it can
> disable (or enable with the right address) ingress
> filtering.
>

I wasn't talking about encrypting the packets, I was talking about
someone
sending a packet with somebody else's MAC address. 

=> I thought that was what you meant by L2 security.

On switched Ethernet,
802.1x
locks down a port to a particular MAC address and no other MAC address
can use
it nor can any MAC address send from another port (though I am told in
practice
that many switch products roll over to using shared access if more hosts
try to
connect than there are ports).

On 802.11, any host can spoof a MAC address, there's no ports to lock
down.

=> Exactly, and I assume 802.11 is is what we're mainly 
talking about, not switched ethernets.

> Anybody
>   > could spoof a standard ND message too.
>
> => This is not the same thing though. Ingress filtering
> was developed as a tool that can help locate attackers.
> The current draft kills that for some unknown period
> of time.
>

Like I said in  a previous email, the ingress filtering can be
established based
on the MAC address. The MAC address is sent by the old router to the new
in the
HI/HaCK exchange. The new router can use that to perform ingress
(actually
egress) filtering.

=> I understood that, but that does not stop anyone
from spoofing the MAC and IP address. The actual 
_values_ will be correct, but there is no way of 
mapping them to the _right_ machine. In other words, 
how does the AR know if these values are coming from the 
MN that the oAR was referring to, and not some other node?

Hesham

---

From: "James Kempf" <[email-masked]>
Date: Fri, 20 Sep 2002 10:47:51 -0700

> MN that the oAR was referring to, and not some other node?

I guess what I am saying is that it doesn't, but absent any specific security
measures on the local link, the same problem applies to any node on the local
link, regardless of whether it has made a handover or not.

            jak